- How do I install junaidnasir/larainvite in a Laravel application?
- Install with composer require junaidnasir/larainvite, then publish the package config and migrations with vendor:publish and run php artisan migrate. Apply the package trait to your User model and register its middleware on the registration routes so signup is gated on a valid invite. Expect roughly half a day to a day for a standard Laravel app, plus time for tests around accept and reject edge cases. In Laravel 11 and 12 there is no default auth scaffolding, so you will need to wire the routes and mail templates yourself.
- Does larainvite support Laravel 12, and which version should I require?
- Release v12.0.0 targets Laravel 12, and major tags now track Laravel major versions rather than the package's own API. Because of that, constrain it to match your framework major exactly, for example ^12.0. Treat every Laravel upgrade as a mandatory package upgrade and diff the source before assuming the bump is compatibility-only.
- Is Laravel 11 still supported by larainvite?
- The available material does not document a parallel Laravel 11 branch, and the changelog jumps from v7.0.0 straight to v12.0.0 with no v8 through v11 history. Check the repository tags before committing to a constraint, and if you are still on Laravel 11, verify which tag actually supports it rather than assuming backwards compatibility. If no maintained tag fits, pinning an older release or forking is the safer path.
- How does larainvite generate and store invitation tokens?
- The overview confirms it generates invite codes and tracks pending and accepted invitations, but the provided documentation does not state whether tokens are stored hashed or in plaintext, or what entropy source is used. Since invite tokens gate account creation, review the Invite model and migration source before production and confirm the tokens are unguessable. If they are stored in plaintext, consider hashing them and comparing on acceptance.
- How do I enforce invite expiry and single-use acceptance?
- The package supports configurable invite expiry and tracks accepted invites, but the published material provides no evidence about how single-use acceptance is enforced. Wrap the accept step in a database transaction with a row lock or conditional update so two concurrent requests cannot both consume the same token. Add explicit tests for expired tokens, already-accepted tokens, and simultaneous acceptance attempts.
- Can I use larainvite with Laravel Breeze, JetStream, or Fortify?
- It fits applications that already use Laravel's session-based, Eloquent-backed authentication with a single users table, which is exactly the Breeze, JetStream, and Fortify stack. You apply the package trait to the User model and attach the package middleware to the registration routes those kits generate. The integration is conventional rather than automatic, so plan on editing the registration controller and invitation email templates.
- Does larainvite work for an API-only or SPA application using Sanctum or Passport?
- This is a poor fit. The package is built around Laravel's session-based registration flow and a single Eloquent users table, not token-based API authentication or custom identity providers. Headless, multi-tenant, or custom-identity architectures would need to fork the flow rather than configure it. If you need invitations in an API-first app, implement the invite model and acceptance endpoint yourself.
- How do I customize the invitation email that larainvite sends?
- Configure your Laravel mail driver as usual, then publish the package views and config so you can edit the invitation email template and expiry settings. Because Laravel 11 and 12 ship without auth scaffolding, you may also need to author the surrounding registration views and routes yourself. Send a test invitation through Mail::fake in a feature test and once through your real driver before shipping.
- Is larainvite actively maintained, and what are the alternatives?
- The repository carries a maintainer required notice and a single maintainer, and one of the two changes in the latest release is an automated Laravel Shift pull request, which signals lifecycle automation rather than active development. For a package this small that can be acceptable, but upstream security fixes may lag. The pragmatic alternative is to wrap it behind your own InvitationService, or implement a small invite model and middleware yourself, so it can be replaced without touching registration code.
- How should I test the larainvite accept and reject flows before production?
- Write feature tests that cover a valid invite, an expired invite, an already-accepted invite, a malformed token, and two concurrent acceptances, using RefreshDatabase and Mail::fake to assert the invitation email is sent. Also confirm the CI matrix actually runs against Laravel 12 on PHP 8.3 and 8.4, since a compatibility-only release does not prove the tests were executed on the new matrix. Combine that with a source diff and a review of token handling before you treat the upgrade as safe.